ThreatFusion AI: AI-Powered Cyber Threat Intelligence Fusion Platform Using Graph Memory and MITRE ATT&CK

Analyst burnout in security operations centers is not mainly a volume problem. It is a structure problem. Logs from endpoints, cloud services, and network devices sit in one tool, while the threat intelligence that would make sense of those logs sits in five or six others. An analyst chasing a suspicious IP typically opens Virus Total, OTX, and a few OSINT feeds manually before getting an answer, and that workflow breaks quickly when the queue has twenty open cases. ThreatFusion AI addresses this at the architecture level. We built a temporal knowledge graph that holds internal telemetry, open-source threat feeds, and MITRE ATT&CK technique mappings in one queryable structure. A team of specialized LLM agents works against that graph to check whether an indicator or behavior pattern has appeared before and which campaign it might belong to. Before any automated containment step executes, a dedicated guardrail agent validates it against policy rules. Low-risk steps go through SOAR automatically; anything higher-impact waits for a human analyst. This paper describes the six-layer architecture, the reasoning behind each design decision, and the evaluation methodology we are running against simulated attack traffic.